KQL Search

This query is designed to detect suspicious activity related to user sign-ins. Specifically, it looks for cases where a user successfully logs in from four or more different countries within a one-hour period. This is considered highly unusual and likely indicates that the user's authentication tokens have been stolen and are being used by attackers from multiple locations.

Here's a simple breakdown of what the query does:

1. Data Source: It uses logs from Azure Active Directory that track non-interactive user sign-ins.

2. Time Frame: It examines sign-in attempts that occurred in the last hour.

3. Successful Logins: It filters for only successful sign-ins (where the result type is 0).

4. Country Count: It groups the data by user and counts the number of distinct countries from which the user has logged in.

5. Alert Condition: If a user has logged in from four or more different countries within the hour, it triggers an alert.

6. Details Captured: For each alert, it captures the list of countries, IP addresses, applications used, and the time range of the logins.

7. Alert Description: The alert is labeled as "Impossible Travel" and includes details about the user and the countries involved.

8. Incident Management: If such an event is detected, an incident is created for further investigation.

This query helps identify potential security breaches where attackers might be using stolen credentials to access a user's account from various global locations simultaneously.